The AWS API Gateway by default limits the maximum number of API keys per account per region to 500, however documentation notes this can be increased by request.
Is there a hard cap on the max upper limit? Are there soft limits for which requests are unlikely to be approved? Can I get to 10K keys on the max upper end?
I'm following the AWS developer portal setup walk-through using API keys for authorization and want to ensure the project reasonably scales beyond 500.
You can easily ask for an increase. But APIG has hard limit for the number of API keys. This limit is currently 10k per region and you cannot go beyond that.
If you need to go beyond that number, I would question if you really tend to create such a service, having 10k different users, with a potential blast radius. You might consider to split up your service into multiple APIGs to minimize the risk.
The other alternative would be create own API key mechanism. You can use Lambda authorizer [1] and store API keys let's say in the DDB.
[1] https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html
Typically if you have a good enough use case you can get limits increased to whatever you need as long as there is enough capacity. In this case, requiring this many keys would likely be scrutinized more since it could be a symptom of an architecture problem that could be solved differently. Like most providers, AWS would prefer you have a solid architecture for your use case so you have a great experience on their platform and also don’t abuse their platform. I’m not saying you have an architecture problem but this type of request would set off some red flags that will require strong justification.
I don't know what's the ceiling regarding keys. It seems they won't tell you unless you specify your use case. I also think that I could hit that 500 keys limit for my use case very easily.
Worst case scenario you can go multi-account, by creating a Cloud-Formation template and replicating your resources across new accounts: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-cloudformer.html
This is not ideal, but it's one of the strategies to go around some of the limits. In your case, you will still want to have the increases for each of the new accounts. Otherwise, you will need to create 20 accounts to satisfy your requirement of 10K keys, and although AWS has a lot of tools and resources to do multi-account management (CloudFormation being one), 20 accounts would be kind of ridiculous.
